Move the shift to another house
const url = 'https://api.aerandil.com/v1/desk/sessions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/move';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"property_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aerandil.com/v1/desk/sessions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/move \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'The person at the desk takes it to another property they work at — one where a staff record claiming their identity has its home (staff_works_at_property): a new desk_session opens there as that record (desk_session.opened), ending when this one would have; this one closes (desk_session.closed); and the answer is a fresh bearer and unlock token for the new shift, running as that record with its role’s scopes and no step-up carried. Only a bearer minted for this session may move it. A property the person has no staff record at is refused. Not idempotency-keyed: the response is a credential.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The desk_session id.
Request Bodyrequired
Section titled “Request Bodyrequired”object
The house the desk moves to; one the person works at.
Examplegenerated
{ "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}Responses
Section titled “Responses”The shift is open at the new house; the old one is closed.
object
Short-lived HS256 JWT. Send as Authorization: Bearer <token> on subsequent calls.
Token lifetime in seconds. Default 3600 (one hour); deployment-configurable via AERANDIL_TOKEN_TTL_SECS.
Space-separated list of granted scopes. The set the token actually carries — already narrowed by any scope request filter and the client’s pre-provisioned grants.
Always Bearer in v1.
Idle seconds after which the desk locks (AERANDIL_DESK_IDLE_LOCK).
The outlet whose till the session is; absent at the front desk.
The houses the person the bearer runs as may hold the desk at — one per front-office staff record claiming their identity — the choices POST /v1/desk/sessions/{id}/move takes.
The desk role the scope vector came from (the F&B roles at a till).
When the shift — and every token minted for it — ends.
The staff member the bearer runs as — its User principal.
Seconds a step-up is honoured for (AERANDIL_DESK_STEP_UP_TTL).
Until when this bearer carries a step-up proof. Absent on the sign-in’s own bearer: an identity-provider session may be silently re-used, so it is not a proof.
On a passcode proof: whether the desk changed hands.
Only when opening: what a locked desk keeps to come back by passcode.
Example
{ "token_type": "Bearer", "role": "front_desk"}Headers
Section titled “Headers”Always no-store. Object and link state is live data and is never cacheable.
desk_session_ended: the shift is closed or spent.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}Not this session’s bearer, not a front-office member of staff, or a property they do not work at.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}already_at_property.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}